Spoofing Vulnerability in Microsoft Exchange Server by Microsoft
CVE-2026-118208

7.1HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Exchange Server Subscription Edition Rtm
Vendor
CVE Published:
10 November 2026

What is CVE-2026-118208?

Improper access control in Microsoft Exchange Server could enable authorized attackers to exploit the system by performing spoofing attacks over the network. This vulnerability poses significant risks to the integrity and authenticity of communications, allowing malicious actors to impersonate legitimate users. It is crucial for organizations using Microsoft Exchange Server to implement the necessary patches and security measures to mitigate this vulnerability and protect against unauthorized access.

Affected Version(s)

Microsoft Exchange Server Subscription Edition RTM x64-based Systems 15.02.0.0 < 15.02.2562.057

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.